Mail server, malware and spam
Office 365 has a simple interface for basic admin options like managing passwords and security groups but you can also use the full Exchange Online interface. This is identical to the Web interface for Exchange Server, so it will be very familiar to Exchange admins. You get a comprehensive set of tools for setting up features like role-based access control, transport rules (such as adding disclaimers to external email) and reports to help you track down any problems along with auditing logs for compliance. If you don't need them then you can stick to the basics and be set up in minutes.
All the key email management features in Office 365 are available through a straightforward interface if you don't want to use the full Exchange interface.
Gmail has vastly fewer options because you don't get to control a mail server, although you do have some control over routing and mail gateway settings. The options are mostly on the level of setting up a vanity URL for users, choosing whether users can use Gmail Labs and chat or allowing Docs results to show up in a Gmail search. With Google looking after the mail server, most businesses won't need more admin options.
There are useful features in Google Apps that aren't turned on by default, and the interface is basic but clear.
Both Google Apps and Office 365 have a mailbox limit of 25GB. There's isn't an archiving option from Gmail, but with Office 365 you have a choice between third-party archiving services or a specific Office 365 plan with unlimited storage for email archiving.
Google Apps for business includes Postini Services for spam and malware detection, but you can't use it is you have multiple domains or if you want to use the Postini Discovery ediscovery and archiving service (in those cases you need to pay for Postini spam services separately). The Postini admin console is separate from the main Google Apps console and has tabs for viewing and deleting or approving messages detected as junk or viruses in the past three days, a week or for as long as it keeps records. The only option for virus blocking is whether you get email notifications that a mail has been quarantined, so you can check and release it if it's a false positive.
For spam you can whitelist individual senders, domains or mailing lists and block specific addresses or domains, set up inbound and outbound content filters for specific words, phrases or patterns and create attachment filters by size or type. You can also choose five levels of spam blocking, from lenient to very aggressive, and use category filters to put more emphasis on blocking explicit, 'racially insensitive' and financial spam. Oddly, IP whitelists to avoid spam filters go under the email settings pane, not in the Postini configuration page.
The Forefront admin console is also separate and has a very different interface from the rest of Office 365; it's powerful but also confusingly complicated for anything except checking quarantined email - we'd like to see this simplified for admins who don't already have Forefront expertise. What you get are the powerful Forefront Online Protection for Exchange (FOPE) tools; not just malware and spam filtering, but options to safelist specific IP addresses, options for auditing and tracing messages and extensive filtering rules for both inbound and outbound email. You can therefore write rules to stop your users emailing out confidential information such as credit card numbers. You can upload dictionary files when you have a lot of values to use in a filter and manage rules by type; there are a lot more options compared to Postini.
Neither service lets you add additional reputation services or real-time block lists, but both let you use SPF for your own reputation - only Google Apps supports DKIM so far.
Winner:Tie. There's no outright winner in this category. Gmail is perfect if you want to get up and running as quickly as possible, while Office 365 provides fine grained controls and capabilities that will suit particularly fastidious organisations.
